What’s Vulnerable › Vulnerabilities

CVE-2020-5256: Remote Code Execution Through Image Uploads in BookStack

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-09 · updated 2026-06-17
• Weakness: CWE-95

Description

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.

Affected products

• bookstackapp/bookstack: before 0.25.3 — fixed in 0.25.3

How to fix

Upgrade to a fixed version: bookstackapp/bookstack 0.25.3. Check the vendor advisory for mitigations.

References

• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hx
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4
• https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hx

Get alerted when CVE-2020-5256 or the next vulnerability affects your stack